License
AGPL-3.0 for the core engine. MIT for the SDKs. Proprietary for the control plane.
IOBOXX uses a three-layer license structure deliberately. Each layer has a different consumer and a different incentive, so the licenses match what each layer needs.
COREAGPL-3.0
The core engine — Object Store, schema system, BPMN engine, federation primitives, MCP servers, real-time subscriptions, embedding pipeline, audit log, the entire Rust object-store module — is AGPL-3.0. Anyone can use, modify, and self-host. Anyone running it as a service for others must open-source their modifications — the AGPL closes the SaaS loophole that MIT- licensed projects leave open.
The choice is deliberate. The cautionary tale is ElizaOS: released under MIT, it fragmented across forks before its technical merit could compound. AGPL keeps the commons coherent — modifications flow back.
SDKSMIT
The SDKs and client libraries — @iobox/lib, @iobox/components, @iobox/ui, the Tauri AR shell, the Pipecat voice integration code, sample applications — are MIT.
The SDK consumers are developers integrating IOBOXX into their own applications. Forcing AGPL on the integrating application would be a non-starter — most enterprise developers can't accept AGPL on their own product code. MIT on the SDKs lets them integrate without legal friction; the core's AGPL still binds anyone who wants to fork the engine itself.
CONTROL PLANEProprietary
The multi-tenant SaaS hosting code — provisioning, billing, federation coordinator, support tooling, the operations console, the cross-twin orchestration — is proprietary and not part of the public repository. Running IOBOXX as a multi-tenant service for others requires authorization. Open-core, closed-SaaS.
This is the same Dify model, with the same intent: prevent cloud providers from packaging IOBOXX as a hosted product without contributing back, while still letting anyone self-host the open-source engine forever.
Contributor licensing
Contributors sign a Contributor License Agreement (CLA) on the AGPL components, allowing IOBOXX to relicense for specific enterprise customers if commercially required. The CLA flow is described under /contributors/join.
In one paragraph
Self-host the core (AGPL) — forever, free. Integrate via the SDKs (MIT) — no obligations on your application code. Don't run a hosted IOBOXX-as-a-service for paying customers without talking to us — that requires the proprietary control plane and an agreement.